IPv6 ECMP is not working as expected in OSPFv3.

This issue is fixed in Cumulus Linux 3.6.2.

The iptables are not counting against the default INPUT chain rule for packets ingressing ethX interfaces.

This issue is fixed in Cumulus Linux 3.6.2.

The buffer monitoring tool on Mellanox switches only shows priority 0 thru 6 for the all_packet_pg statistics; priority 7 is not shown.

This issue is fixed in Cumulus Linux 3.6.2.

When using PTP and switchd.service is restarted, the PTP services need to be restarted after switchd.service with the following commands:

systemctl reset-failed ptp4l.service phc2sys.service
systemctl restart  ptp4l.service phc2sys.service

This issue is fixed in Cumulus Linux 3.6.2.

VRF Route Leaking is not supported on Mellanox platforms in CL 3.6.0. Attempts to configure a VRF with a nexthop from another VRF can result in an sx_sdk daemon crash and loss of forwarding functionality.

This issue is fixed in Cumulus Linux 3.6.2.

During switchd restart, the RS FEC configuration is not re-installed to the interfaces to which it was previously applied.

This issue is fixed in Cumulus Linux 3.6.2.

When you upgrade to Cumulus Linux 3.6.x, static routes configured in the frr.conf file become associated with the VRF configured above them.

This issue is fixed in Cumulus Linux 3.6.2.

Changing tcam_resource_profile to acl-heavy on a switch with VXLAN enabled and attempting to apply the configuration with a switchd restart, causes switchd to fail to restart, netd to crash, the switch to become temporarily unresponsive, and a cl-support to be generated.

To work around this issue, remove the acl-heavy profile or the VXLAN configuration.

This issue is fixed in Cumulus Linux 3.6.2.

Mellanox switches do not install traps in hardware to send multicast traffic to the kernel, even after registering the multicast group.

This issue is fixed in Cumulus Linux 3.6.2.

A remote VRR MAC that is normally learned through an EVPN Type-2 route is learned locally on a host-facing port. This is then propagated through a new Type-2 MAC route throughout the environment and remote access switch pairs install the erroneous route.

To work around this issue, re-send the EVPN update from the infra pair by changing the VRR MAC or clearing the session.

This issue is fixed in Cumulus Linux 3.6.2.

The following CVEs were announced in Debian Security Advisory DSA-4196-1 and affect the Linux kernel.

This issue is fixed in Cumulus Linux 3.6.2.

--------------------------------------------------------------------------

Debian Security Advisory DSA-4196-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

May 08, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: linux

CVE ID: CVE-2018-1087 CVE-2018-8897

Debian Bug: 897427 897599 898067 898100

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.

CVE-2018-1087

Andy Lutomirski discovered that the KVM implementation did not properly handle #DB exceptions while deferred by MOV SS/POP SS, allowing an unprivileged KVM guest user to crash the guest or potentially escalate their privileges.

CVE-2018-8897

Nick Peterson of Everdox Tech LLC discovered that #DB exceptions that are deferred by MOV SS or POP SS are not properly handled, allowing an unprivileged user to crash the kernel and cause a denial of service.

For the oldstable distribution (jessie), these problems have been fixed in version 3.16.56-1+deb8u1. This update includes various fixes for regressions from 3.16.56-1 as released in DSA-4187-1 (Cf. #897427, #898067 and #898100).

For the stable distribution (stretch), these problems have been fixed in version 4.9.88-1+deb9u1. The fix for CVE-2018-1108 applied in DSA-4188-1 is temporarily reverted due to various regression, cf. #897599.

For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

When ERSPAN is enabled on a Mellanox switch and non_atomic_update_mode = TRUE, traffic through the switch is blocked.

This issue is fixed in Cumulus Linux 3.6.2.

If you run the net del interface <interface> bridge vids command, the interface is removed from the bridge ports list instead of inheriting the characteristics of the bridge.

To work around this issue, add the interface back to the bridge with the net add bridge bridge ports <interface> command.

This issue is fixed in Cumulus Linux 3.6.2.

The following CVE was announced in Debian Security Advisory DSA-4212-1 and affects the git package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4212-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

May 29, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : git

CVE ID : CVE-2018-11235

Etienne Stalmans discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability exploitable via specially crafted submodule names in a .gitmodules file.

For the oldstable distribution (jessie), this problem has been fixed in version 1:2.1.4-2.1+deb8u6.

For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u3.

We recommend that you upgrade your git packages.

For the detailed security status of git please refer to its security tracker page at: https://security-tracker.debian.org/tracker/git

The following CVE was announced in Debian Security Advisory DSA-4222-1 and affects the gnupg2 package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4222-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

June 08, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : gnupg2

CVE ID : CVE-2018-12020

Marcus Brinkmann discovered that GnuGPG performed insufficient sanitisation of file names displayed in status messages, which could be abused to fake the verification status of a signed email.

Details can be found in the upstream advisory at https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html

For the oldstable distribution (jessie), this problem has been fixed in version 2.0.26-6+deb8u2.

For the stable distribution (stretch), this problem has been fixed in version 2.1.18-8~deb9u2.

For the detailed security status of gnupg2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/gnupg2

The following CVEs were announced in Debian Security Advisory DSA-4226-1 and affect the perl package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4226-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

June 12, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : perl

CVE ID : CVE-2018-12015

Debian Bug : 900834

Jakub Wilk discovered a directory traversal flaw in the Archive::Tar module, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted tar archive.

For the oldstable distribution (jessie), this problem has been fixed in version 5.20.2-3+deb8u11.

For the stable distribution (stretch), this problem has been fixed in version 5.24.1-3+deb9u4.

We recommend that you upgrade your perl packages.

For the detailed security status of perl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl

The following CVEs were announced in Debian Security Advisory DSA-4186-1 and affect the gunicorn package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4186-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

April 28, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : gunicorn

CVE ID : CVE-2018-1000164

It was discovered that gunicorn, an event-based HTTP/WSGI server was susceptible to HTTP Response splitting.

For the oldstable distribution (jessie), this problem has been fixed in version 19.0-1+deb8u1.

We recommend that you upgrade your gunicorn packages.

For the detailed security status of gunicorn please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/gunicorn

This issue is fixed in Cumulus Linux 3.6.2.

The following CVEs were announced in Debian Security Advisory DSA-4208-1 and affect the procps package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4208-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

May 22, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : procps

CVE ID : CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126

Debian Bug : 899170

The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2018-1122

top reads its configuration from the current working directory if no $HOME was configured. If top were started from a directory writable by the attacker (such as /tmp) this could result in local privilege escalation.

CVE-2018-1123

Denial of service against the ps invocation of another user.

CVE-2018-1124

An integer overflow in the file2strvec() function of libprocps couldresult in local privilege escalation.

CVE-2018-1125

A stack-based buffer overflow in pgrep could result in denial of service for a user using pgrep for inspecting a specially crafted process.

CVE-2018-1126

Incorrect integer size parameters used in wrappers for standard allocators could cause integer truncation and lead to integer overflow issues.

For the oldstable distribution (jessie), these problems have been fixed in version 2:3.3.9-9+deb8u1.

For the stable distribution (stretch), these problems have been fixed in version 2:3.3.12-3+deb9u1.

For the detailed security status of procps, refer to its security tracker page at: https://security-tracker.debian.org/tracker/procps

A full readable description of the vulnerabilities is here: https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt

They are all local issues only, Denial of Service, and a top privilege escalation.

It's been reported that splitting a switch port removes it from the bridge.

This issue is fixed in Cumulus Linux 3.6.2.

The following CVEs were announced in Debian Security Advisory DSA-4202-1 and affect the curl package.

This issue is fixed in Cumulus Linux 3.6.2.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4202-1 security@debian.org

https://www.debian.org/security/ Alessandro Ghedini

May 16, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : curl

CVE ID : CVE-2018-1000301

Debian Bug : 898856

OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.

For the oldstable distribution (jessie), this problem has been fixed in version 7.38.0-4+deb8u11.

For the stable distribution (stretch), this problem has been fixed in version 7.52.1-5+deb9u6.

For the detailed security status of curl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/curl

After upgrading to Cumulus Linux 3.6.1 on Facebook Backpack switches, NCLU configuration fails to commit because of the default ip-forward and ip6-forward configuration.

This issue is fixed in Cumulus Linux 3.6.2.

If hosts nodes reflect or bridge a frame received from access switch pairs back to the switches, a remote VRR virtual MAC that is normally learned through an EVPN type-2 MAC+IP (centralized advertise-default-gw) route is learned locally on a host-facing port. This is then propagated through a new type-2 MAC route throughout the environment and remote access switch pairs install the erroneous route.

To work around this issue, resend the EVPN update from the infra pair by changing the VRR MAC or clear the session.

This is a known issue that is currently being investigated.

A bridge with double tag translation configured on a member interface correctly maps the VLAN tags in the outgoing ARP request frame, but incorrectly maps the VLAN tags on the incoming ARP reply.

This is a known issue that is currently being investigated.

ACL-related metrics reported by cl-resource-query on a Mellanox MLX-2700 switch return all ACL metrics as 0. For example:

cumulus@mlx-2700-08:~$ sudo cl-resource-query 
Host entries:              34,   0% of maximum value   5120
IPv4 neighbors:             8
IPv6 neighbors:            13
IPv4 entries:           32768,  82% of maximum value  39936
IPv6 entries:               0,   0% of maximum value  15360
IPv4 Routes:            32768
IPv6 Routes:                0
Total Routes:           32768, 100% of maximum value  32768
ECMP nexthops:             64,   0% of maximum value 209664
MAC entries:                0,   0% of maximum value 409600
Ingress ACL entries:        0,   0% of maximum value      0
Ingress ACL counters:       0,   0% of maximum value      0
Ingress ACL meters:         0,   0% of maximum value      0
Ingress ACL slices:         0,   0% of maximum value      0
Egress ACL entries:         0,   0% of maximum value      0
Egress ACL counters:        0,   0% of maximum value      0
Egress ACL meters:          0,   0% of maximum value      0
Egress ACL slices:          0,   0% of maximum value      0

To work around this issue, run the Mellanox sx_api_resource_manager_dump_all.py debug utility:

cumulus@mlx-2700-08:~$ sudo sx_api_resource_manager_dump_all.py > tmp-cl-resq
cumulus@mlx-2700-08:~$ cat tmp-cl-resq
[+] opening sdk 
[0/1847]
sx_api_open handle:0x14c3724 , rc 0 
HW Table Utilization
Utilization for HW resource TCAM  is 42.9
Utilization for HW resource KVD Hash is 69.9
Utilization for HW resource KVD Linear is 49.9
Utilization for HW resource PGT is 0.0
Utilization for HW resource Flow Counter is 0.0
Utilization for HW resource ACL Regions is 1.0
Logical Free Entries Count
============================================================
|                                Resource|   Free Entries|
============================================================
|                           UC MAC Table |          67181|
|                           MC MAC Table |          67181|
|                      FIB IPV4 UC Table |         132628|
|                      FIB IPV6 UC Table |          95802|
|                      FIB IPV4 MC Table |           2288|
|                         ARP IPV4 Table |          32569|
|                         ARP IPV6 Table |          12292|
|                 Unicast Adjacency Table|           8197|
|                    L2 MC VECTORS Table |           6999|
|             ACL Extended Actions Table |           8197|
|                           ACL PBS Table|           8197|
|                              eRIF List |           8197|
|                               ILM Table|          67181|
|                              VLAN Table|              1|
|                            VPorts Table|          67181|
|                               FID Table|          16362|
|             Policy Based MPLS ILM Table|           8197|
|                             ACL Regions|            396|
|                       ACL Rules 18B Key|           2254|
|                       ACL Rules 32B Key|           1024|
|                       ACL Rules 54B Key|           1022|
|                       RIF Counter Basic|           3276|
|                    RIF Counter Enhanced|           1092|
|                            Flow Counter|           2048|
|                       ACL GROUPS Table |            396|
Logical Table Utilization
================================================================================================
|                 Resource|       HW Table|Logical Entries |     HW Entries| Utilization(%)|
================================================================================================
|            UC MAC Table |       KVD Hash|             43|             43|            0.0|
|       FIB IPV4 UC Table |       KVD Hash|             89|          65790|           26.5|
|       FIB IPV6 UC Table |       KVD Hash|             51|          28926|           11.6|
|       FIB IPV4 MC Table |          TCAM |              0|            192|            1.1|
|          ARP IPV4 Table |       KVD Hash|            199|          32768|           13.2|
|          ARP IPV6 Table |       KVD Hash|           4092|          32768|          179.6|
|  Unicast Adjacency Table|     KVD Linear|           8187|           8187|           49.9|
|             VPorts Table|       KVD Hash|              0|             22|            0.0|
|                FID Table|       KVD Hash|             22|             22|            0.0|
|              ACL Regions|    ACL Regions|              4|              4|            1.0|
|        ACL Rules 18B Key|          TCAM |              2|             64|            0.3|
|        ACL Rules 54B Key|          TCAM |              2|           5760|           35.1|
|        ACL GROUPS Table |ACL Group Table|              4|            400|          100.0|
cumulus@mlx-2700-08:~$

This is a known issue and should be fixed in a future release of Cumulus Linux.

On a Cumulus Linux switch, if a bridge has VXLAN interfaces, then the arp_accept and arp_ignore options do not work for any switch virtual interfaces (SVIs).

To work around this issue, disable ARP suppression on the VXLAN interfaces. For example, if the VXLAN is named vni100, disable ARP suppression on it with the following command:

cumulus@switch:~$ net add vxlan vni100 bridge arp-nd-suppress off
cumulus@switch:~$ net commit

This issue should be fixed in a future release of Cumulus Linux.

Routes that are learned from an EVPN cloud don't get summarized. Only routes that reside on or are owned by a switch get summarized.

This is a known issue and should be fixed in a future release of Cumulus Linux.

Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to Debian Stretch release.

Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable, but the vulnerability has not been fixed upstream in Debian yet.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4231-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

June 17, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : libgcrypt20

CVE ID : CVE-2018-0495

It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.

For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3.

We recommend that you upgrade your libgcrypt20 packages.

For the detailed security status of libgcrypt20 please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/libgcrypt20

This issue will be fixed in a future version of Cumulus Linux when a fix made available for Debian Jessie.

Because VXLAN encapsulation uses a full range of source ports, it is possible for Cumulus Linux switches to generate packets with UDP source ports numbered lower than 1023. This might result in the traffic being mishandled in your network if you have rules in place to handle this traffic differently. For example, you might have DSCP setup for this port range.

To work around this issue, avoid using the well known port range for sourcing VXLAN traffic.

This issue should be fixed in a future release of Cumulus Linux.

If you have any pending changes in the NCLU buffer, when you run net show config command or net show config interface <interface>, the output displays the pending configuration, not the one that was previously committed.

This issue should be fixed in a future release of Cumulus Linux.

When adding new SVIs and static VRF routes in FRR, the appropriate VRF is applied to the interface in the kernel after the static routes are configured in FRR. When the kernel interface changes to the appropriate VRF, FRR next-hop resolution is not updated with the valid connected next-hop interface.

To work around this issue, remove and re-add the static routes.

This issue is being investigated at this time.

A Cumulus Linux switch cannot manage Docker containers running on 500 hosts. Entries in table 10 start to expire and are removed from the table.

To work around this issue, modify the ebtable rules for set-rate and set-burst, increasing their values until the issue is resolved. For example, configure set-rate=1200 and set-burst=300.

This issue is being investigated at this time.

On a Maverick switch, if auto-negotiation is configured on a 10G interface and the installed module does not support auto-negotiation (for example, 10G DAC, 10G Optical, 1G RJ45 SFP), the link breaks.

To work around this issue, disable auto-negotiation on interfaces where it is not supported. See the Interface Configuration Recommendations for information about configuring auto-negotiation.

This issue is being investigated at this time.

When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:

"/etc/frr/daemons was modified by another user."

Despite this error being returned, the change still goes through, and the description gets removed from the frr.conf file.

This issue is fixed in Cumulus Linux 3.7.0.

On a Mellanox switch, when you change the VRF membership of an interface with VRR enabled, the VRR MAC address is not properly programmed into hardware.

To work around this issue, delete and recreate the interface using ifup and ifdown.

This is a known issue that is currently being investigated.

On the Broadcom switch, TPID programming is not reset when there is a configuration change. As a result, you see unexpected packet drops.

This is a known issue that is currently being investigated.

A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur.

This is a known issue that is currently being investigated.

On the Broadcom Trident II+ and Maverick based switch, in an external VXLAN routing environment, when a lookup is done on the external-facing switch (exit/border leaf) after VXLAN decapsulation, the switch does not rewrite the MAC addresses and TTL; for through traffic, packets are dropped by the next hop instead of correctly routing from a VXLAN overlay network into a non-VXLAN external network (for example, to the Internet).

This issue affects all traffic from VXLAN overlay hosts that need to be routed after VXLAN decapsulation on an exit/border leaf, including:

• Traffic destined to external networks (through traffic)
• Traffic destined to the exit leaf SVI address

To work around this issue, modify the external-facing interface for each VLAN sub-interface by creating a temporary VNI and associating it with the existing VLAN ID.

For example, if the expected interface configuration is:

auto swp3.2001
iface swp3.2001
    vrf vrf1
    address 45.0.0.2/24
# where swp3 is the external facing port and swp3.2001 is the VLAN sub-interface
auto bridge
iface bridge
bridge-vlan-aware yes
bridge ports vx-4001
bridge-vids 4001
auto vx-4001
iface vx-4001
vxlan-id 4001
<… usual vxlan config …>
bridge-access 4001
# where vnid 4001 represents the L3 VNI
auto vlan4001
iface vlan4001
vlan-id 4001
vlan-raw-device bridge
vrf vrf1

Modify the configuration as follows:

auto swp3
iface swp3
    bridge-access 2001
# associate the port (swp3) with bridge 2001
auto bridge
iface bridge
bridge-vlan-aware yes
bridge ports swp3 vx-4001 vx-16000000
bridge-vids 4001 2001
# where vx-4001 is the existing VNI and vx-16000000 is a new temporary VNI
# this is now bridging the port (swp3), the VNI (vx-4001),
# and the new temporary VNI (vx-16000000)
# the bridge VLAN IDs are now 4001 and 2001
auto vlan2001
iface vlan2001
vlan-id 2001
vrf vrf1
address 45.0.0.2/24
vlan-raw-device bridge
# create a VLAN 2001 with the associated VRF and IP address
auto vx-16000000
iface vx-16000000
vxlan-id 16000000
bridge-access 2001
<… usual vxlan config …>
# associate the temporary VNI (vx-16000000) with bridge 2001
auto vx-4001
iface vx-4001
vxlan-id 4001
<… usual vxlan config …>
bridge-access 4001
# where vnid 4001 represents the L3 VNI
auto vlan4001
iface vlan4001
vlan-id 4001
vlan-raw-device bridge
vrf vrf1

With EVPN symmetric routing (including type-5 routes) you can only advertise host routes or prefix routes learned through EVPN to a VRF peer if EVPN peering uses BGP unnumbered. If the BGP peering is numbered, the NEXTHOP of MP_REACH attribute is not included, which causes the neighbor to reply with a BGP notification.

This issue is fixed in Cumulus Linux 3.6.1.

Inserting a 1000 BASE-T RJ-45 SFP adapter into a Maverick QCT LY7, Tomahawk + AS7312 or DNI AG5648 switch causes portwd to fail to start, resulting in the switch being unusable.

To work around this issue, do not use 1000BASE-T RJ-45 modules on the impacted switches.

This issue is fixed in Cumulus Linux 3.6.1.

The NCLU net add and net del commands are missing for the default originate EVPN type-five route feature.

This issue is fixed in Cumulus Linux 3.6.1.

Issuing the net add bgp neighbor command with swp1, swp2 or swp1-2 causes the following error:

TB NameError: global name 'ifname_expand_glob' is not defined.

This issue is fixed in Cumulus Linux 3.6.1.

ACL rules that only allow ARP packets prevent ARP packets from reaching SVIs.

This issue is fixed in Cumulus Linux 3.6.1.

When upgrading from Cumulus Linux 3.3.2 to 3.6.0 using the netd.conf file from version 3.3.2, netd fails to start and displays the error ImportError: No module named frr-reload.

This issue is fixed in Cumulus Linux 3.6.1.

The following CVEs were announced in Debian Security Advisory DSA-4172-1 and affect the perl package.

This issue is fixed in Cumulus Linux 3.6.1.

--------------------------------------------------------------------------

Debian Security Advisory DSA-4172-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

April 14, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : perl

CVE ID : CVE-2018-6797 CVE-2018-6798 CVE-2018-6913

Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2018-6797

Brian Carpenter reported that a crafted regular expression could cause a heap buffer write overflow, with control over the bytes written.

CVE-2018-6798

Nguyen Duc Manh reported that matching a crafted locale dependent regular expression could cause a heap buffer read overflow and potentially information disclosure.

CVE-2018-6913

GwanYeong Kim reported that 'pack()' could cause a heap buffer write overflow with a large item count.

For the oldstable distribution (jessie), these problems have been fixed in version 5.20.2-3+deb8u10. The oldstable distribution (jessie) update contains only a fix for CVE-2018-6913.

For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u3.

We recommend that you upgrade your perl packages.

For the detailed security status of perl please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/perl

When you run the net add bgp neighbor <interface> command, the interface is only added if previously defined.

This issue is fixed in Cumulus Linux 3.6.1.

On a Mellanox switch, when you withdraw one ECMP next hop, the neighbor entry for that next hop is missing from the hardware.

To work around this issue, manually delete the ARP entry from kernel with the arp -d command to repopulate it in the hardware.

This issue should be fixed in an upcoming release of Cumulus Linux.

On Maverick 100G switches, after enabling FEC on links with 100G AOC cables, random links do not come up after a reboot.

To work around this issue, disable FEC on 100G AOC links.

This issue is being investigated at this time.

When configuring layer 2 VPN EVPN in vtysh, if a route-target matches both the AS number and the VNI number, the route target does not display in the configuration. This is currently the default behavior.

This issue is being investigated at this time.

After moving an IP address to a new host, the neighbor table and EVPN routes do not update properly after receiving a GARP from the new MAC address to which the previously-active IP address has been moved.

This issue is being investigated at this time.

In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.

To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information.

When you use the net show bridge macs command and a MAC address has just been updated, the never keyword improperly displays in the command output.

This issue is being investigated at this time.

When using the NCLU command to add a redundant DHCP relay, the command exits with an error instead of displaying a message that the DHCP relay server configuration already contains the IP address.

This issue is being investigated at this time.

On Mellanox switches, the destination MAC of ERSPAN GRE packets is set to all zeros; therefore, the packets are dropped by the first transient switch.

This issue is being investigated at this time.

When you use NCLU to delete an interface, the associated configuration is not removed from the frr.conf file.

This issue is being investigated at this time.

When you upgrade to Cumulus Linux 3.6.x, static routes configured in the frr.conf file become associated with the VRF configured above them.

This issue is currently being investigated.

When upgrading from a previous release to Cumulus Linux 3.6, TACACS-authenticated users mapped to tacacs0 thru tacacs15 users with the netshow or netedit user groups cannot run net commands and they see the following error:

ERROR: You do not have permission to execute that command

This behavior is seen when upgrading with simple authentication only and occurs without a restricted shell for command authorization being enabled.

This problem is not present on a binary install of 3.6.0 or 3.6.1 and only happens when upgrading from previous releases.

To work around this issue, edit the /etc/netd.conf file, add the tacacs user group to the groups_with_show list, and add the tacacs15 user to the users_with_edit list as below:

# Control which users/groups are allowed to run "add", "del",
# "clear", "abort", and "commit" commands.
users_with_edit = root, cumulus, vagrant, tacacs15
groups_with_edit = netedit
# Control which users/groups are allowed to run "show" commands.
users_with_show = root, cumulus, vagrant
groups_with_show = netshow, netedit, tacacs

After making this change, restart netd with the sudo systemctl restart netd command.

Changing tcam_resource_profile to acl-heavy on a switch with VXLAN enabled and attempting to apply the configuration with a switchd restart, causes switchd to fail to restart, netd to crash, the switch to become temporarily unresponsive, and a cl-support to be generated.

To work around this issue, remove the acl-heavy profile or the VXLAN configuration.

This issue is currently being investigated.

The Mellanox SN2700 or SN2700B switch appears to be unresponsive for at least three minutes after a PDU power cycle is issued, if any of the following occur:

• A shutdown or poweroff command is executed
• A temperature sensor hits a critical value and shuts down the box

To fix this, update the system CPLD to version CPLD000085. Contact Mellanox support for assistance.

The default port group discards_pg does not accept packet_extended or packet_all collection types.

This issue is fixed in Cumulus Linux 3.6.0.

1G and 100M speeds on SFP ports are not working on the Dell S4148T-ON.

To enable a speed lower than 10G on a port on the S4148T platform, you must dedicate an entire port group (four interfaces) to a lower speed setting. Within a port group, you can mix 1G and 100M speeds, if needed. You cannot mix 10G and lower speeds.

To work around this issue:

1. In the /etc/cumulus/ports.conf file, add each of the four ports in the port group as 1G interfaces. You must set each of the ports in the port group to be 1G. Port groups are swp1-4, swp5-8, swp9-12, and so on, and starting with swp31-35 on the right half of the switch. For example, to enable ports swp5-swp8 to autonegotiate to 100M or 1G speeds, add the following to the ports.conf file:
   

   5=1G
   6=1G
   7=1G
   8=1G

2. Restart switchd:
   

   cumulus@switch:~$ sudo systemctl reset-failed switchd; sudo systemctl restart switchd

   After this is done ports swp5-8 will be enabled to autonegotiate with the neighbor devices to 1G or 100M speeds.

As of 3.5.1, 1G interfaces are supported when using the ports.conf file workaround as described above. As of 3.6.0, editing the ports.conf file is no longer required.

The output for the NCLU net show config command is incorrect.

This issue is fixed in Cumulus Linux 3.6.0.

1G and 100M speeds on SFP ports do not work automatically on Dell S4148F-ON and S4128F-ON switches.

To enable a speed lower than 10G on a port on the S4148F and S4128F platforms, you must dedicate an entire port group (four interfaces) to a lower speed setting. Within a port group, you can mix 1G and 100M speeds, if needed. You cannot mix 10G and lower speeds.

This issue is fixed in Cumulus Linux 3.6.0.

Running the net add hostname <hostname> command updates both the /etc/hostname file and the/etc/hosts file. However, NCLU modifies the hostname value passed to the /etc/hostname file, removing certain characters and converting the hostname to lowercase, whereas the hostname passed to the /etc/hosts file is passed through as is, creating an inconsistency between the two files.

To work around this issue, manually set the hostname in both the /etc/hostname file and the /etc/hosts file using a text editor such as vi or nano.

This issue is fixed in Cumulus Linux 3.6.0.

For type-5 routes, when an MLAG pair is used as border leaf nodes, the MLAG primary and secondary nodes use their respective loopback IP addresses as the originator IP address to start, but switch to using the MLAG anycast IP address after an FRR restart.

This issue is fixed in Cumulus Linux 3.6.0.

Whenever FRR is restarted, it deletes all routes in the kernel with a protocol type of BGP, ISIS, OSPF, and static. When you upgrade FRR and the service is stopped, the static routes defined in the /etc/network/interfaces file and installed using ifupdown2 are also removed.

To work around this issue, configure static routes in the /etc/network/interfaces file as follows:

post-up ip route add  via  proto kernel

For example:

auto swp2
iface swp2
  post-up ip route add 0.0.0.0/0 via 192.0.2.249 proto kernel

This issue is fixed in Cumulus Linux 3.6.0.

When running the netshow lldp command, the output displays the following error:

cumulus@switch:~# netshow lldp
ERROR: The lldpd service is running, but '/usr/sbin/lldpctl -f xml' failed.

However, the NCLU net show lldp command works correctly.

This issue is fixed in Cumulus Linux 3.6.0.

The pam_syslog() interface is now being used to send messages to the system logger, which changes the message format. For example, with an incorrect password, the old message format for TACACS Plus is:

Feb 27 21:06:02 switch3 PAM-tacplus[17368]: auth failed 2

The new message format for TACACS Plus is:

Feb 27 21:04:08 switch3 sshd[16676]: pam_tacplus(sshd:auth): auth failed 2

This issue is fixed in Cumulus Linux 3.6.0.

When you run the vtysh -c 'show ipv6 route ospf json' command to show IPv6 routes through OSPF, you see the error Unknown route type. To work around this issue, you must specify ospf6 in the command:

cumulus@switch:~$  vtysh -c 'show ipv6 route ospf6 json'

This issue is fixed in Cumulus Linux 3.6.0.

The following CVE was announced in Debian Security Advisory DSA-4110-1, and affects the exim4 package. While this package is no longer in the Cumulus Linux installation image, it is still in the repo3 repository. Cumulus Linux is built on Debian Jessie.

This issue is fixed in Cumulus Linux 3.6.0.

-------------------------------------------------------------------------
Debian Security Advisory DSA-4110-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
February 10, 2018 https://www.debian.org/security/faq
-------------------------------------------------------------------------
Package : exim4
CVE ID : CVE-2018-6789
Debian Bug : 890000
Meh Chang discovered a buffer overflow flaw in a utility function used in the SMTP listener of Exim, a mail transport agent. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially the execution of arbitrary code via a specially crafted message.
For the oldstable distribution (jessie), this problem has been fixed in version 4.84.2-2+deb8u5.
For the stable distribution (stretch), this problem has been fixed in version 4.89-2+deb9u3.

The following CVEs were announced in Debian Security Advisory DSA-4098-1, and affect the curl package.

This issue is fixed in Cumulus Linux 3.6.0.

-------------------------------------------------------------------------
Debian Security Advisory DSA-4098-1 security@debian.org
https://www.debian.org/security/ Alessandro Ghedini
January 26, 2018 https://www.debian.org/security/faq
-------------------------------------------------------------------------
Package : curl
CVE ID : CVE-2018-1000005CVE-2018-1000007
Two vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2018-1000005
Zhouyihai Ding discovered an out-of-bounds read in the code handling HTTP/2 trailers. This issue doesn't affect the oldstable distribution (jessie).

CVE-2018-1000007
Craig de Stigter discovered that authentication data might be leaked to third parties when following HTTP redirects.

For the oldstable distribution (jessie), these problems have been fixed in version 7.38.0-4+deb8u9.

The following CVE was announced in Debian Security Advisory DSA-4089-1, and affects the bind9 package.

This issue is fixed in Cumulus Linux 3.6.0.

-------------------------------------------------------------------------
Debian Security Advisory DSA-4089-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 16, 2018 https://www.debian.org/security/faq
-------------------------------------------------------------------------
Package : bind9

CVE ID : CVE-2017-3145
Jayachandran Palanisamy of Cygate AB reported that BIND, a DNS server implementation, was improperly sequencing cleanup operations, leading in some cases to a use-after-free error, triggering an assertion failure and crash in named.

For the oldstable distribution (jessie), this problem has been fixed in version 1:9.9.5.dfsg-9+deb8u15.

For the stable distribution (stretch), this problem has been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u4.

We recommend that you upgrade your bind9 packages.

The following CVEs were announced in Debian Security Advisory DSA-4086-1, and affect the Linux kernel.

This issue is fixed in Cumulus Linux 3.6.0.

--------------------------------------------------------------------------
Debian Security Advisory DSA-4082-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 09, 2018 https://www.debian.org/security/faq
--------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2017-8824 CVE-2017-15868 CVE-2017-16538
CVE-2017-16939 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450
CVE-2017-17558 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806
CVE-2017-17807 CVE-2017-1000407 CVE-2017-1000410

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-8824

Mohamed Ghannam discovered that the DCCP implementation did not correctly manage resources when a socket is disconnected and reconnected, potentially leading to a use-after-free. A local user could use this for denial of service (crash or data corruption) or possibly for privilege escalation. On systems that do not already have the dccp module loaded, this can be mitigated by disabling it:

echo >> /etc/modprobe.d/disable-dccp.conf install dccp false

CVE-2017-15868

Al Viro found that the Bluebooth Network Encapsulation Protocol (BNEP) implementation did not validate the type of the second socket passed to the BNEPCONNADD ioctl(), which could lead to memory corruption. A local user with the CAP_NET_ADMIN capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-16538

Andrey Konovalov reported that the dvb-usb-lmedm04 media driver did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash).

CVE-2017-16939

Mohamed Ghannam reported (through Beyond Security's SecuriTeam Secure Disclosure program) that the IPsec (xfrm) implementation did not correctly handle some failure cases when dumping policy information through netlink. A local user with the CAP_NET_ADMIN capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-17448

Kevin Cernekee discovered that the netfilter subsystem allowed users with the CAP_NET_ADMIN capability in any user namespace, not just the root namespace, to enable and disable connection tracking helpers. This could lead to denial of service, violation of network security policy, or have other impact.

CVE-2017-17449

Kevin Cernekee discovered that the netlink subsystem allowed users with the CAP_NET_ADMIN capability in any user namespace to monitor netlink traffic in all net namespaces, not just those owned by that user namespace. This could lead to exposure of sensitive information.

CVE-2017-17450

Kevin Cernekee discovered that the xt_osf module allowed users with the CAP_NET_ADMIN capability in any user namespace to modify the global OS fingerprint list.

CVE-2017-17558

Andrey Konovalov reported that that USB core did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash or memory corruption), or possibly for privilege escalation.

CVE-2017-17741

Dmitry Vyukov reported that the KVM implementation for x86 would over-read data from memory when emulating an MMIO write if the kvm_mmio tracepoint was enabled. A guest virtual machine might be able to use this to cause a denial of service (crash).

CVE-2017-17805

Dmitry Vyukov reported that the KVM implementation for x86 would over-read data from memory when emulating an MMIO write if the kvm_mmio tracepoint was enabled. A guest virtual machine might be able to use this to cause a denial of service (crash).

CVE-2017-17806

It was discovered that the HMAC implementation could be used with an underlying hash algorithm that requires a key, which was not intended. A local user could use this to cause a denial of service (crash or memory corruption), or possibly for privilege escalation.

CVE-2017-17807

Eric Biggers discovered that the KEYS subsystem lacked a check for write permission when adding keys to a process's default keyring. A local user could use this to cause a denial of service or to obtain sensitive information.

CVE-2017-1000407

Andrew Honig reported that the KVM implementation for Intel processors allowed direct access to host I/O port 0x80, which is not generally safe. On some systems this allows a guest VM to cause a denial of service (crash) of the host.

CVE-2017-1000410

Ben Seri reported that the Bluetooth subsystem did not correctly handle short EFS information elements in L2CAP messages. An attacker able to communicate over Bluetooth could use this to obtain sensitive information from the kernel.

For the oldstable distribution (jessie), these problems have been fixed in version 3.16.51-3+deb8u1.

Certain Dell Z9100 switches running Cumulus Linux have a different string coded in the Manufacturer field of the SMBIOS/DMI information. This discrepancy sometimes causes a problem with timing during the boot sequence that leaves switchd in a failed state.

To work around this issue, perform either a single cold reboot (power cycle the switch) or two warm reboots (run the reboot command twice).

This issue is fixed in Cumulus Linux 3.6.0.

When the switch or snmpd is running for more than 497 days, the following error message repeats in syslog:

snmpd[xxxx]: truncating integer value > 32 bits

This issue is resolved by limiting the number of log messages to 10 occurrences.

Security: Debian Security Advisory DSA-4154-1 for net-snmp issue
CVE-2015-5621
CVE-2018-1000116

The following CVE was announced in Debian Security Advisory DSA-4154-1, and affects the net-snmp package.

This issue is fixed in Cumulus Linux 3.6.0.

Debian Security Advisory DSA-4154-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 28, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : net-snmp
CVE ID : CVE-2015-5621CVE-2018-1000116
Debian Bug : 788964 894110

A heap corruption vulnerability was discovered in net-snmp, a suite of
Simple Network Management Protocol applications, triggered when parsing
the PDU prior to the authentication process. A remote, unauthenticated
attacker can take advantage of this flaw to crash the snmpd process
(causing a denial of service) or, potentially, execute arbitrary code
with the privileges of the user running snmpd.

For the oldstable distribution (jessie), these problems have been fixed
in version 5.7.2.1+dfsg-1+deb8u1.

For the stable distribution (stretch), these problems have been fixed
before the initial release.

We recommend that you upgrade your net-snmp packages.

For the detailed security status of net-snmp please refer to its
https://security-tracker.debian.org/tracker/net-snmp

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

For an incoming VXLAN encapsulated packet, the inner packet does not match on the TCP port successfully after decapsulation.

This issue is fixed in Cumulus Linux 3.6.0.

The link-down yes configuration in the /etc/network/interfaces file has no effect on shutting down SVI interfaces configured in a VRF. SVIs configured without a VRF are not affected.

This issue is fixed in Cumulus Linux 3.6.0.

The internal loopback ports on a Tomahawk switch should be set to the highest speed of which the port is capable. However, due to a software defect, the ports can be set to 40G, which throttles traffic. When configuring Tomahawk internal loopback ports, make sure the port is not configured to a speed other than 100G. If it is, first remove the configuration on that port, reboot the system, then reconfigure the loopback port in the /etc/cumulus/ports.conf file.

This issue is fixed in Cumulus Linux 3.6.0.

On Mellanox Spectrum platforms, cl-ecmpcalc reports that the nexthop does not have multiple paths. For example:

Error: traffic to IP Address:31.0.0.31 will not ECMP

This issue is fixed in Cumulus Linux 3.6.0.

The output for the net show interface command can be more than 130 characters wide without line wrapping, which can be difficult to read on a 80 character wide terminal.

This issue is fixed in Cumulus Linux 3.6.0. The net show interface output is now fewer than 80 characters long for 80 character wide terminals.

Removing all NTP servers from the configuration with the net del ntp server * command (using * as a wildcard to match all servers) causes netd to crash.

This issue is fixed in Cumulus Linux 3.6.0.

When a BFD session fails in a point-to-point network, the OSPF adjacency with the neighbor is not brought down.

This issue is fixed in Cumulus Linux 3.6.0.

When you disable IP forwarding on an interface with the NCLU ip forward off command and commit the change, the command shows as unsupported when you run net show configuration commands.

This issue is fixed in Cumulus Linux 3.6.0.

The default syslog severity level for DHCP Relay is 6, which causes too many syslog messages.

This issue is fixed in Cumulus Linux 3.6.0.

Reloading a running FRR instance without a restart fails and generates errors in the log due to code failing dependencies.

This issue is fixed in Cumulus Linux 3.6.0.

The netd process crashes when you run the net show lldp command and does not recover.

This issue is fixed in Cumulus Linux 3.6.0.

Link Local IPv6 addresses cannot be used to source SSH traffic inside a VRF such as the management VRF.

This issue is fixed in Cumulus Linux 3.6.0.

The following CVEs were announced in Debian Security Advisory DSA-4140-1, and affect the libvorbis package.

This issue is fixed in Cumulus Linux 3.6.0

The following CVEs were announced in Debian Security Advisory DSA-4100-1, and affect the tiff package.

This issue is fixed in Cumulus Linux 3.6.0.

Debian Security Advisory DSA-4100-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
January 27, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : tiff
CVE ID : CVE-2017-9935CVE-2017-11335CVE-2017-12944CVE-2017-13726
CVE-2017-13727CVE-2017-18013

Multiple vulnerabilities have been discovered in the libtiff library and
the included tools, which may result in denial of service or the
execution of arbitrary code.

For the oldstable distribution (jessie), these problems have been fixed
in version 4.0.3-12.3+deb8u5.

For the stable distribution (stretch), these problems have been fixed in
version 4.0.8-2+deb9u2.
We recommend that you upgrade your tiff packages.

For the detailed security status of tiff, please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tiff

The following CVEs were announced in Debian Security Advisory DSA-4132-1, and affect the libvpx package.

This issue is fixed in Cumulus Linux 3.6.0.

-------------------------------------------------------------------------
Debian Security Advisory DSA-4132-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
March 04, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : libvpx
CVE ID : CVE-2017-13194

It was discovered that incorrect validation of frame widths in the libvpx
multimedia library may result in denial of service and potentially the
execution of arbitrary code.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.3.0-3+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.6.1-3+deb9u1.

We recommend that you upgrade your libvpx packages.

For the detailed security status of libvpx please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libvpx

The following CVEs were announced in Debian Security Advisory DSA-4073-1, and affect the linux package.

This issue is fixed in Cumulus Linux 3.6.0.

Debian Security Advisory DSA-4073-1 security@debian.org
https://www.debian.org/security/
December 23, 2017 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2017-8824 CVE-2017-16995 CVE-2017-17448
CVE-2017-17449 CVE-2017-17450 CVE-2017-17558
CVE-2017-17712 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806
CVE-2017-17807 CVE-2017-1000407 CVE-2017-1000410

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2017-8824

Mohamed Ghannam discovered that the DCCP implementation did not
correctly manage resources when a socket is disconnected and
reconnected, potentially leading to a use-after-free. A local
user could use this for denial of service (crash or data
corruption) or possibly for privilege escalation. On systems that
do not already have the dccp module loaded, this can be mitigated
by disabling it:
echo >> /etc/modprobe.d/disable-dccp.conf install dccp false

CVE-2017-16995

Jann Horn discovered that the Extended BPF verifier did not
correctly model the behaviour of 32-bit load instructions. A
local user can use this for privilege escalation.

CVE-2017-17448

Kevin Cernekee discovered that the netfilter subsystem allowed
users with the CAP_NET_ADMIN capability in any user namespace, not
just the root namespace, to enable and disable connection tracking
helpers. This could lead to denial of service, violation of
network security policy, or have other impact.

CVE-2017-17449

Kevin Cernekee discovered that the netlink subsystem allowed
users with the CAP_NET_ADMIN capability in any user namespace
to monitor netlink traffic in all net namespaces, not just
those owned by that user namespace. This could lead to
exposure of sensitive information.

CVE-2017-17450

Kevin Cernekee discovered that the xt_osf module allowed users
with the CAP_NET_ADMIN capability in any user namespace to modify
the global OS fingerprint list.

CVE-2017-17558

Andrey Konovalov reported that that USB core did not correctly
handle some error conditions during initialisation. A physically
present user with a specially designed USB device can use this to
cause a denial of service (crash or memory corruption), or
possibly for privilege escalation.

CVE-2017-17712

Mohamed Ghannam discovered a race condition in the IPv4 raw socket
implementation. A local user could use this to obtain sensitive
information from the kernel.

CVE-2017-17741

Dmitry Vyukov reported that the KVM implementation for x86 would
over-read data from memory when emulating an MMIO write if the
kvm_mmio tracepoint was enabled. A guest virtual machine might be
able to use this to cause a denial of service (crash).

CVE-2017-17805

It was discovered that some implementations of the Salsa20 block
cipher did not correctly handle zero-length input. A local user
could use this to cause a denial of service (crash) or possibly
have other security impact.

CVE-2017-17806

It was discovered that the HMAC implementation could be used with
an underlying hash algorithm that requires a key, which was not
intended. A local user could use this to cause a denial of
service (crash or memory corruption), or possibly for privilege
escalation.

CVE-2017-17807

Eric Biggers discovered that the KEYS subsystem lacked a check for
write permission when adding keys to a process's default keyring.
A local user could use this to cause a denial of service or to
obtain sensitive information.

CVE-2017-1000407

Andrew Honig reported that the KVM implementation for Intel
processors allowed direct access to host I/O port 0x80, which
is not generally safe. On some systems this allows a guest
VM to cause a denial of service (crash) of the host.

CVE-2017-1000410

Ben Seri reported that the Bluetooth subsystem did not correctly
handle short EFS information elements in L2CAP messages. An
attacker able to communicate over Bluetooth could use this to
obtain sensitive information from the kernel.

Debian disables unprivileged user namespaces by default, but if they
are enabled (via the kernel.unprivileged_userns_clone sysctl) then
CVE-2017-17448 can be exploited by any local user.

When a static route is removed from the zebra routing table because an interface is transitioning to down state, the static route remains inactive when the interface comes back up if an alternate route still exists.

This issue is fixed in Cumulus Linux 3.6.0.

Removing a bridge using ifupdown2 does not remove it from the FRR configuration files. However, restarting FRR successfully removes the bridge.

This issue is being investigated at this time.

When link pause or priority flow control (PFC) is enabled on a Broadcom Tomahawk-based switch and there is over-subscription on a link, where the ASIC sends pause frames aggressively, the upstream switch does not throttle enough.

If you need link pause or PFC functionality, use a switch that does not use the Tomahawk ASIC.

In some instances, ARP requests are not suppressed in a VXLAN active-active scenario, but instead get flooded over VXLAN tunnels. This issue is caused because there is no control plane syncing the snooped local neighbor entries between the MLAG pair; MLAG does not perform this sync, and neither does EVPN.

This issue is being investigated at this time.

When a Tomahawk switch has 512 VXLAN interfaces configured, the switchd heartbeat fails. This can cause switchd to dump core.

To work around this issue, disable VXLAN statistics in switchd. Edit /etc/cumulus/switchd.conf and comment out the following line:

cumulus@switch:~$ sudo nano /etc/cumulus/switchd.conf
…
#stats.vxlan.member = BRIEF
…

Then restart switchd for the change to take effect. This causes all network ports to reset in addition to resetting the switch hardware configuration.

cumulus@switch:~$ sudo systemctl restart switchd.service

The Maverick switch limits multicast traffic by the lowest speed port that has joined a particular group.

This issue is being investigated at this time.

The MLAG neighbor entries are deleted when the switch goes down; however, the ARP table is out of sync when the bond comes back up and the system MAC address is changed.

To work around this issue, ping the SVI address of the MLAG switch or issue an arping command to the host from the broken switch.

If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.

To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary.

When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack).

This issue is being investigated at this time.

SBUS error warnings display on Tomahawk switches.

This issue is being investigated at this time.

On Broadcom switches, IPv4 and IPv6 multicast traffic always maps into queue 0.

This issue is being investigated at this time.

When you configure DHCP relay with VRR, the ifreload command does not work as expected; for example, the IP address might be removed from an SVI.

This issue is currently being investigated. 

In EVPN environments, sticky MAC addresses move from one bridge port to another on soft nodes.

This issue is currently being investigated.

PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7.

This issue should be fixed in an upcoming release of Cumulus Linux.

The iptables are not counting against the default INPUT chain rule for packets ingressing ethernet interfaces.

This issue should be fixed in an upcoming release of Cumulus Linux.

On a Mellanox switch, when you withdraw one ECMP next hop, the neighbor entry for that next hop is missing from the hardware.

To work around this issue, manually delete the ARP entry from kernel with the arp -d command to repopulate it in the hardware.

This issue should be fixed in an upcoming release of Cumulus Linux.

The net show interface command output displays the mode as Access/L2 instead of Trunk/L2, or vice versa (Trunk/L2 mode is displayed instead of Access/L2).

This issue should be fixed in an upcoming release of Cumulus Linux.

If you create an interface name that includes a hyphen (-), Cumulus Linux treats the interface as a range of interfaces.

This issue should be fixed in an upcoming release of Cumulus Linux.

When using VRF Route leaking on Mellanox switches in a VLAN-unaware bridge configuration, the packets for a locally attached leaked host are software forwarded.

This issue should be fixed in an upcoming release of Cumulus Linux.

The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs.

This issue is currently being investigated.

The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing.

This issue is currently being investigated.

Routes in a VRF learned through iBGP or multi-hop eBGP are marked as installed even when they are not installed in the source VRF.

This issue is currently being investigated.

VRF Route Leaking is not supported on Mellanox platforms in 3.6.0. Attempts to configure a VRF with a nexthop from another VRF can result in an sx_sdk daemon crash and loss of forwarding functionality. Do not configure VRF import to leak routes between VRFs.

This issue should be fixed in an upcoming release of Cumulus Linux.

IPv6 RAs from a router can be used to do some host auto-configuration. The main aspects that can be auto-configured are the prefixes which are on-link (which can be used by the host to autoconfigure its addresses) and the default router. Some other information can also be indicated. FRR does have support to "advertise" some of these parameters. To work around this issue, configure the prefixes explicitly for announcement through RA using the IPv6 nd prefix command.

This issue should be fixed in an upcoming release of Cumulus Linux.

On Maverick 4148T switches, the l2C bus can hang, causing the fans and temperature sensors to be unreadable and the log file to fill with the error message:

ismt_smbus 0000:00:13.0 completion wait timed out

To work around this issue, reboot the switch.

This issue should be fixed in an upcoming release of Cumulus Linux.

NCLU reports an error when attempting to configure FRR when the configured hostname begins with a digit:

unknown: buffer_flush_available: write error on fd -1: Bad file descriptor

To work around this issue, change the hostname of the switch to begin with an alphabetic character; not a digit.

This issue should be fixed in an upcoming release of Cumulus Linux.

On the Dell S4148 switch, when you try to configure any of the ports on the second pipeline (port 31-54) into a gang (40G/4) through the ports.conf file, switchd fails.

This issue is currently being investigated.

If you start rdnbrd in an EVPN configuration, local and remote neighbor entries are deleted. Enabling rdnbrd in an EVPN configuration is not supported.

When BGP multipath is enabled, EVPN prefix (type-5) routes imported into a VRF always form multipath across paths that originate even from a different neighbor AS. This happens even if the as-path-relax configuration is disabled or not applied.

This issue should be fixed in an upcoming release of Cumulus Linux.

When you use the apt-get upgrade command to upgrade to Cumulus Linux 3.6.0 and you select to keep the currently-installed version of netd.conf (by typing N at the prompt), netd fails to start after reboot and you see errors in the logs when you try to restart it.

This issue is being investigated at this time.

A bridge loop causes frames that arrive through EVPN to be forwarded back to the EVPN bridge. After resolving the forwarding loop, the bridge FDB table recovers, but BGP does not recover automatically. Because the MAC appears to move rapidly, BGP installs the remote MAC as a local entry and advertises it out. Even though the bridge FDB table appears to be correct, bridged traffic destined to the misprogrammed MAC fails.

This issue should be fixed in an upcoming release of Cumulus Linux.

Cumulus Linux 3.6.0 or later does not forward transit precision time protocol (PTP) packets as PTP is not enabled by default in Cumulus Linux.

To work around this issue, do one of the following:

• Downgrade the switch to Cumulus Linux 3.5.3.
• Enable PTP on the Cumulus Linux switch. Edit /etc/cumulus/switchd.conf and set ptp.timestamping to TRUE.

This issue should be fixed in an upcoming release of Cumulus Linux.